Court in California orders millions of student records to be released…..what?!?!?

 

When I was a freshman in college (bear with me, it wasn’t that long ago) I had to take a required class called “Critical Thinking.” As the title suggests, it was a course designed to teach college freshmen how to discern fact from fiction. Our professor particularly focused on teaching us the skills to read articles and decide whether they presented enough evidence to be reliable sources. I am fairly certain my professor would have been disappointed at the first draft of this blog post. I jumped to a conclusion and did the opposite of what she taught us – I did not go to the sources for clarification. News came out that California will soon release the personal information of students to a non-profit community organization and I was alarmed and immediately assumed the worst. Thankfully, my wonderful privacy peeps pulled me back from the abyss and I applied my learnings to a rewrite of the original post.

According to reports, millions of public school student records are to be handed over to the Concerned Parents Association. This organization fought in court for the data to be released in spite of objections from the California Department of Education. The intent of the organization is admirable. The Concerned Parents Association aims to determine whether California schools are violating the Individuals with Disabilities Education Act (IDEA). In order to do so, they believe they need access to all information of children K-12 who are or at some point were students in the California school system since 2008. I am sure most of us that work with students with IEP’s (Individualized Education Plans) or 504 plans have more than one story to tell in which students rights under IDEA were violated. In order for this analysis to be done millions of records with student names, address, date of birth, behavior and mental information as well as health and expulsion records will be released. It’s easy to jump to conclusions regarding the safety and privacy of such sensitive information and be concerned that the information of students will be accessible and vulnerable to misuse.

But this is what I found in the court order (not everything is listed and the complete protocols can be found here) –

  • Discussions were held between the plaintiffs and the CDE regarding safeguarding student data and the court approved the security process outlined in the plaintiff’s proposed discovery protocol
  • Plaintiff’s counsel will carry a third party risk assessment of their IT infrastructure and protocol for storing and transmitting student data
  • All sensitive data transmitted will be on fully encrypted external hard drives
  • Plaintiffs are to confirm deletion of any copies of sensitive data once it has been uploaded from the external hard drives to a fully secure server

There are other protocols outlined in the court case such as maintaining a copy of all devices used to store or access the data, maintaining a list of all the names and positions of individuals who may access this information during discovery as well as the protocols to be used to notify the affected students of this undertaking as well as the opt-out form they can use if they choose to have their information removed.

While this process may not be ideal, at least there is the comfort that the court addressed some of the issues that would arise from the movement of such a massive database outside the CDE’s system. I still have concerns and I am not entirely comfortable with the idea of releasing such a big database in this format as I think it creates vulnerabilities for those records in which students could be identified. I would prefer if the data was de-identified and I don’t believe the court addressed this. The Future of Privacy Forum wrote an excellent paper on de-identification of student data (shameless plug but it’s a great paper!) There are many de-identification techniques that can be used depending on the disclosure and risk level of the data without compromising the integrity of such information.

Is the court approved protocol to safeguard the privacy of these students adequate? I am not so sure. There is a good outline on the security measures required in the transfer of files and storage but there is a difference between privacy and security. De-identifying data is not the only way to protect the privacy of students. There is also a dire need for individuals working with this information to be trained on how to maintain these databases securely to ensure the privacy of all students. Sometimes because of lack of understanding data is not handled properly and student data is exposed because it was uploaded to…..Dropbox……

Lesson learned, don’t jump to conclusions. The protocols for handling the data in this case may not be perfect but it is not the free for all scenario that is depicted in some news outlets. I am encouraged that organizations are looking to advocate for students, in particular those with disabilities, and I hope that this case brings more awareness to the need of adequate security protocols for data transfer as well as additional training for those involved in working with student data.

If you’d like to read the court order, you can find it here.

Next time I promise my college professors to apply what they so diligently taught me through my college career…..pinky promise…..

 

School Officials? What do they do and who are they?

 

 

When we talk about protecting student data, we typically think of apps or student portals holding student data and the challenges of protecting this data. But the reality behind these electronic archiving mediums is that there are many human beings involved in the creation and maintenance of such systems. There are also many individuals and organizations that interact with schools on a daily basis that effectively act on behalf of the school to perform these services such as bus companies or lunch room system administrators. These individuals or organizations are called “school officials”. Under FERPA, a school official can be a teacher, counselor, admissions officer or a contractor, consultant or any organization to which a school has outsourced their services.

Students are increasingly using tech in the classroom and this technology is provided and managed by a third party (Google for example) and thus fall under the “school official” designation. We could hold a debate regarding the many concerns of multiple individuals having access to highly sensitive data. However, outsourcing services is not unusual in other environments, whether it be business, finance, technology or even medicine. And these third party providers and any sub-providers, are bound by the policies of the company they are contracted to. Parents and students have valid concerns on the amount of metadata being collected and how this is used by the school vendors. Companies are not as transparent as they need to be for us to understand their products and how the data is handled. But we also need to build a bridge between third party contractors and parents. We probably didn’t expect that our kids would go to school and have their data captured in such a way, but since this is inevitable, schools should inform parents of who the providers are so that at a minimum parents are not left wondering how their children’s data is captured and secured.

The Future of Privacy Form wrote an article on this particular topic and explains thoroughly what a school official really means and the responsibilities they hold as such.

It is important to note that although many individuals or organizations will be designated “school officials” that does not mean that they have an inherent right to all education records pertaining to students. Schools designate what information each school official receives and should be responsible when making the decision of how much data a particular vendor can have access to. A school official is in a unique position in which they may have access to tremendous amounts of information about students but they should be held accountable and act responsibly towards this data. I would love to see more communication between parents and schools regarding their school’s “school official” in order for us to understand what tasks they are performing and what data is needed.  For the most part, we don’t know what apps our kids are using in school and we should have access to that information. Some could argue that providing parents with a list of all the outsource resources they use is a burden on the school, but really, all that is needed is a list of “school officials” on a website so that we can understand who the school is working with. Transparency is key and it will help build the bridge between schools and parents on how and when their children’s data will be used in school and for what purpose.

 

 

Can we “quantify” students and protect their privacy?

 

When I was in high school, a moon or two ago, I was offered a “career aptitude test” that was supposed to determine what career was best for me based on my responses. Most of us laughed at the results that came of that test. It’s 2016 and some argue that this is the year of the quantified student. Will students today laugh at that concept 20 years from now?

At first glance, one would think that the more information we can collect, analyze and provide back to students would enable them to make better choices in their education and how they carve their educational and professional paths. The claim being that with better visibility in one’s own learning patterns and behaviors we can better control the outcome of our development. With increased use of computers and apps, students are generating massive amounts of data. Data that can tell a comprehensive story of that student’s learning history as well as learning patterns, strengths and weaknesses. If we can quantify our learning then we have better insight into ourselves. But is that really the case? How do students react to the information given to them about their reading skills or mathematic learning patterns? Will students be able to see this information as a useful tool, or will they allow algorithms to determine their path? And as exciting as knowing more about ourselves may be we need to take a step back and ask the question – is it to the benefit of the student to be quantified?

More data is not necessarily more beneficial data. School should be the environment in which students are allowed to make mistakes, decide to take a class so out of their comfort zone that they might discover something new. School is the time in which mistakes can be made without fearing permanent consequences. But if we quantify student learning to such granular detail are we preventing high school students from experimenting with opportunities that can guide them to a rich a college experience?

Let’s not forget privacy. Who decides what information can be disclosed or to whom? As the quantified data grows we increasingly profile students, making the risk of exposing their data much greater. Are we protecting the student’s data trail enough that they can sufficiently control what others can see? Thus the argument continues for how to balance the ideal amount of information to enrich a student’s learning experience and control disclosure without exposing an entire dossier of information on a particular student. It seems to me that as we increasingly quantify student learning we risk shifting the focus of student data from one that is for the benefit of students to one that is for the benefit of someone else. To me that is not what student data should be about. Student data should be created, analyzed and used for the benefit of the student. If we allow quantified student data to be made available to colleges to create market driven skill sets, we are in fact negating student ownership of data. Students cease to become the focal point of education and become a product being formed to satisfy a market need and we cannot ignore students in that way.

We must understand that while generating data to quantify student progress and learning is important, we cannot create an environment that is prioritizing market needs over student needs. A student should be able to determine the educational story they choose to disclose and not have only algorithms determine the path they are to take.